CVE-2026-72418

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A regression in the netfilter component causes packets for valid connections to be dropped when using connlimit for soft-limiting scenarios. This occurs when a new connection reuses a socket in the TIME WAIT state, causing the connection tracking entry to be evaluated as already confirmed. The nf conncount add() function incorrectly skips the addition if the connection is confirmed and does not originate from the loopback interface, returning -EEXIST. This triggers a garbage collection process that cleans up the TIME WAIT connection, reducing the active connection count to 0. This state is mishandled by xt connlimit, resulting in the false rejection of valid new connections.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.